AWS Permission Analyzer

What does the AWS result show?

For a supported AWS IAM user access key in a connected account, Cremit uses the analyzer role to identify the IAM user and collect that user’s inline and attached policy documents and group names. This is policy context for investigation. It is not a simulation of whether a particular action against a particular resource would succeed. The current worker does not collect group policy documents, permissions boundaries, organization policies or resource policies as part of this result. Those controls can change the effective decision.

Temporary ASIA credentials are not supported by this IAM user policy analysis. A key without a matching analyzer, an unreadable policy or a failed AWS API call can produce a skipped or failed state. Check the status and analysis time on the finding instead of treating every AWS finding as analyzed. A policy document also does not prove that the key was used against a resource.

Connect the AWS account

In Cremit Platform, open Security → Permission Analysis and add an AWS analyzer for the 12-digit account ID and region. Cremit creates an analyzer record and an AWS CloudFormation launch link with an External ID. Open the stack in the intended AWS account, inspect the current template and trust policy, and complete deployment. Return to Cremit and verify the connection. The linked AWS cloud integration path may also provide this analyzer capability.

The analyzer’s policy allows the IAM reads used for analysis. The current standalone CloudFormation template also grants permissions scoped to updating its own stack and managing its own role policy. Review the exact template before deployment rather than relying on a blanket “read-only role” label. The External ID is a trust condition for cross-account assumption; it is not a substitute for checking the role principal and permissions.

Check a finding and respond

Choose a supported IAM user access-key finding associated with the connected account. Confirm the analyzer connection and the finding’s analysis status, then inspect the user ARN, attached and inline policy documents and group names. For an access question, confirm permissions boundaries, group policies, AWS Organizations controls, resource policies and the actual request context in AWS. Do not interpret a listed action as proven reachable access.

If the key is exposed, identify its current workload owner and rotate or revoke it at AWS after checking dependencies. Removing the source text alone does not disable the key. There is no guaranteed analysis duration or automatic remediation in this integration.

Primary documentation

AWS IAM policy evaluation logic

AWS cross-account External IDs

Cremit finding relationships